The vulnerability lies in the import_users.php file where providing the raw_password parameter with the value CICT_2026 forces the system to use a hard‑coded password, allowing an attacker to bypass authentication. The attack can be launched remotely without needing any prior credentials. This flaw exposes the essential authentication mechanism, enabling unauthorized access to administrative and potentially user areas of the application.

The issue applies to SourceCodester’s Onlne Examination & Learning Management System and Syllabus‑aligned Learning Management and Examination System. No specific version information is supplied in the CVE data, so the scope covers all released versions of these products under the SourceCodester brand.

The CVSS score is 6.9, indicating medium‑to‑high severity. The exploit can be initiated remotely by sending a crafted raw_password argument to import_users.php. EPSS information is not publicly disclosed, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw removes any authentication barrier, it is readily exploitable by any actor who can reach the vulnerable endpoint.